CVE-2026-45538 OpenSIPS CVE debrief

Who should care

Defenders responsible for OpenSIPS deployments, particularly those whose routing script invokes the sip_to_json() function, should assess exposure and prioritize remediation. This vulnerability can be exploited with a single unauthenticated UDP packet, making it a high-priority issue for SIP server administrators.

Why it matters

CVE-2026-45538 is a critical vulnerability in OpenSIPS that can cause a stack buffer overflow when processing SIP messages with header names longer than 255 bytes. This issue affects OpenSIPS versions 4.0.0 and prior, and can be exploited with a single unauthenticated UDP packet. Defenders responsible for OpenSIPS deployments should assess exposure and prioritize remediation, particularly if their routing script invokes the sip_to_json() function.

• Potential remote code execution on builds without stack protections.
• Unauthenticated denial-of-service (crash) of the OpenSIPS process.
• Verification of OpenSIPS version and sip_to_json() function usage in routing scripts.
• Implementation of compensating controls to limit SIP message header name length.

Technical summary

The OpenSIPS implementation of a Session Initiation Protocol (SIP) server is vulnerable to a stack buffer overflow when processing SIP messages with header names longer than 255 bytes. This occurs in the sip_to_json() function (modules/sipmsgops/sipmsgops.c), which copies SIP header names into a fixed 255-byte stack buffer without bounds checking. A single unauthenticated UDP packet to the SIP port (5060) can crash the process or, on builds without stack protections, potentially allow remote code execution.

Defensive priority

High

Recommended defensive actions

• Immediately assess exposure by checking if the routing script invokes the sip_to_json() function.
• Verify the OpenSIPS version and upgrade to a fixed version if possible.
• Implement compensating controls, such as limiting SIP message header name length.
• Monitor for suspicious SIP traffic and implement additional security measures to prevent exploitation.
• Perform an asset inventory to identify potentially affected systems.
• Review change management windows for applying patches or mitigations.
• Track and verify the source of vulnerability reports for further updates.

Evidence notes

The vulnerability is caused by the sip_to_json() function in modules/sipmsgops/sipmsgops.c, which copies SIP header names into a fixed 255-byte stack buffer without bounds checking. This can lead to a stack buffer overflow when a SIP message with a header name longer than 255 bytes is processed.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.